1. draft-kwatsen-netconf-zerotouch-00 Zero Touch Provisioning for NETCONF Call Home

2. Introduction Zero Touch is a strategy for how to establish a secure network management relationship between a newly delivered network element, configured with just its factory default settings, and the new owner's NMS. 2

3. Goals Security – MUST implement vs MUST use (RFC 3365) Flexibility – Works on SP networks, even if behind a firewall Ease of Use – Play-n-play for Installer (“zero” means zero!) Device Cost – Mild (COGS + development effort) 3

4. Proposal illustrated in following slides 4

5. Device State Precondition +--------------------------------+ | | | +----------------------+ | | | | | | | device private key | | | | device certificate | | | +----------------------+ | | | | FQDN of vendor's DNS server | +--------------------------------+ 5 Serial Number Signed by certificate with chain of trust to Vendor’s well-known CA

6. Vendor's DNS Server State +-------------------------------------------------+ | | |. | | - FQDN of NMS to connect to | | - flag indicating if SSH or TLS | | - username NMS will login using | | - NMS's auth credentials | | | +-------------------------------------------------+ 6 State initialized through a vendor-hosted interface

7. ZeroTouch Sequence Diagram DEVICE LOCAL DHCP LOCAL DNS VENDOR'S DNS NMS | SERVER SERVER SERVER (DNSSEC) | | | | | | |------------>| | | | | Lease IP | | | | | | | | | |------------------------------->| | | | Lookup vendor's DNS server | | | | | | | | |---------------------------------------------->| | | Lookup. | | | | | | | |------------------------------->| | | | Lookup NMS IP address | | | | | | | | |------------------------------------------------------------->| | Reverse SSH or Reverse TLS | | | | | | | | 7

8. NMS State Precondition +----------------------------------------+ | | | vendor's trusted CA certificate | | serial numbers for expected devices | | username to log into devices with | | auth credentials to log into devices | | | +----------------------------------------+ 8 NMS needs CA cert and serial-numbers from Vendor

9. Supporting Private Networks Potential alternatives to source information: – Impersonate vendor’s DNS server – DHCP (susceptible to a MITM attack?) – USB flash drive – Near-field wireless 9 Or just to avoid doing a lookup in the vendor’s DNS server?

10. Security Considerations Long-lived certificates Vendor may reveal NMS locations Serial Number in certificate 10

11. IANA Considerations None 11

12. Open Issues DNSSEC doesn't currently allow client certificates Should DNS record provide SSH-specific information? Standardize REST API used to set DNS record info? Not in -00 draft: Use something besides DNS? (e.g. HTTPS) 12

13. Questions / Concerns ? 13